diff --git a/deployment/aws-terraform/1-services/fsx-csi.tf b/deployment/aws-terraform/1-services/fsx-csi.tf new file mode 100644 index 0000000..d8647a8 --- /dev/null +++ b/deployment/aws-terraform/1-services/fsx-csi.tf @@ -0,0 +1,32 @@ +resource "helm_release" "fsx_csi_driver" { + count = local.use_fsx + namespace = "kube-system" + + name = "aws-fsx-csi-driver" + repository = "https://kubernetes-sigs.github.io/aws-fsx-csi-driver/" + chart = "aws-fsx-csi-driver" + + set { + name = "controller.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" + value = module.fsx_csi_irsa[0].iam_role_arn + } + + set { + name = "node.serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn" + value = module.fsx_csi_irsa[0].iam_role_arn + } +} + +resource "kubernetes_storage_class_v1" "fsx_sc" { + count = local.use_fsx + metadata { + name = "fsx-sc" + } + storage_provisioner = "fsx.csi.aws.com" + parameters = { + subnetId = tolist(module.eks.vpc_private_subnet_ids)[0] + securityGroupIds = module.eks.cluster_security_group + deploymentType = "PERSISTENT_2" + } + depends_on = [ helm_release.fsx_csi_driver[0] ] +} diff --git a/deployment/aws-terraform/1-services/irsa.tf b/deployment/aws-terraform/1-services/irsa.tf index c1c4663..012eaac 100644 --- a/deployment/aws-terraform/1-services/irsa.tf +++ b/deployment/aws-terraform/1-services/irsa.tf @@ -49,6 +49,26 @@ module "efs_csi_irsa" { tags = local.tags } +module "fsx_csi_irsa" { + count = local.use_fsx + + source = "terraform-aws-modules/iam/aws//modules/iam-role-for-service-accounts-eks" + + role_name_prefix = "fsx-csi-${local.cluster_name}" + attach_fsx_lustre_csi_policy = true + + oidc_providers = { + main = { + provider_arn = module.eks.oidc_provider_arn + namespace_service_accounts = [ + "kube-system:fsx-csi-controller-sa" + ] + } + } + + tags = local.tags +} + module "efs_csi_irsa_node" { count = local.use_efs @@ -96,3 +116,17 @@ resource "kubernetes_annotations" "efs_csi_node_annotation" { "eks.amazonaws.com/role-arn": module.efs_csi_irsa_node[0].iam_role_arn } } + +# resource "kubernetes_annotations" "fsx_csi_controller_annotation" { +# count = local.use_fsx + +# api_version = "v1" +# kind = "ServiceAccount" +# metadata { +# name = "fsx-csi-controller-sa" +# namespace = "kube-system" +# } +# annotations = { +# "eks.amazonaws.com/role-arn": module.fsx_csi_irsa[0].iam_role_arn +# } +# } diff --git a/deployment/aws-terraform/1-services/locals.tf b/deployment/aws-terraform/1-services/locals.tf index 7d710cb..a2a5e81 100644 --- a/deployment/aws-terraform/1-services/locals.tf +++ b/deployment/aws-terraform/1-services/locals.tf @@ -3,6 +3,7 @@ locals { db_count = var.create_rds_instance ? 1 : 0 cognito_pool_count = var.create_cognito_pool ? 1 : 0 use_efs = var.use_efs_csi ? 1 : 0 + use_fsx = var.use_fsx_csi ? 1 : 0 tags = { Name = var.project_prefix diff --git a/deployment/aws-terraform/1-services/variables.tf b/deployment/aws-terraform/1-services/variables.tf index e7dae1a..e084484 100644 --- a/deployment/aws-terraform/1-services/variables.tf +++ b/deployment/aws-terraform/1-services/variables.tf @@ -50,6 +50,12 @@ variable "use_efs_csi" { default = false } +variable "use_fsx_csi" { + type = bool + description = "Install CSI driver for FSx for Lustre volumes" + default = false +} + variable "r53_rds_private_hosted_zone" { type = string default = null